cbomctl 0.1.0__py3-none-any.whl

cbomctl/cli.py

@@ -0,0 +1,242 @@
+"""CLI. Subcommands only — no logic lives here."""
+
+from __future__ import annotations
+
+import sys
+from datetime import date
+from pathlib import Path
+from typing import Annotated
+
+import typer
+
+from cbomctl.config import Config
+from cbomctl.loader import CbomParseError, read_assets
+from cbomctl.models import Interpretation, RuleStatus
+from cbomctl.policy.schema import available, load_pack, load_packs
+from cbomctl.report import json_out, markdown, matrix_text, sarif
+from cbomctl.scoring import mosca
+from cbomctl.verdict.conflicts import detect
+from cbomctl.verdict.matrix import build
+
+app = typer.Typer(
+    add_completion=False,
+    help=("Evaluate a CycloneDX CBOM against several national post-quantum "
+          "policies at once and report where their verdicts contradict."),
+    no_args_is_help=True,
+)
+
+DEFAULT_JURISDICTIONS = "bsi-de,anssi-fr,asd-au,cnsa-2.0"
+
+
+def _fail(msg: str) -> None:
+    typer.secho(f"error: {msg}", fg=typer.colors.RED, err=True)
+    raise typer.Exit(2)
+
+
+@app.command()
+def verdict(
+    cbom: Annotated[str, typer.Argument(help="CBOM JSON path, or - for stdin.")],
+    jurisdictions: Annotated[str, typer.Option("--jurisdictions", "-j")] = DEFAULT_JURISDICTIONS,
+    config: Annotated[Path | None, typer.Option("--config", "-c")] = None,
+    fmt: Annotated[str, typer.Option("--format", "-f", help="matrix|json|md|sarif")] = "matrix",
+    source_format: Annotated[str, typer.Option("--from", help="auto|cyclonedx|sbom-tools")] = "auto",
+    crqc_year: Annotated[int, typer.Option("--crqc-year")] = mosca.DEFAULT_CRQC_YEAR,
+    migration_years: Annotated[float | None, typer.Option("--migration-years")] = None,
+    strict: Annotated[bool, typer.Option("--strict", help=(
+        "Unverified rules return INDETERMINATE rather than asserting a verdict, "
+        "and indeterminate findings exit 3."))] = False,
+    require_verified: Annotated[bool, typer.Option("--require-verified-policy", help=(
+        "Refuse to run against any pack containing an unverified rule."))] = False,
+    fail_on_warn: Annotated[bool, typer.Option("--fail-on-warn")] = False,
+    cnsa_acquisition_gate: Annotated[bool, typer.Option("--cnsa-acquisition-gate", help=(
+        "Include the CNSA 2.0 January 2027 acquisition gate. It is a "
+        "procurement condition on new NSS acquisitions, not an algorithm "
+        "deadline, so it is off by default."))] = False,
+) -> None:
+    """Per-asset × jurisdiction verdicts, plus the conflicts between them."""
+    try:
+        assets, detected = read_assets(cbom, source_format)
+    except CbomParseError as exc:
+        _fail(str(exc))
+    if not assets:
+        _fail("no cryptographic assets found — is this a CBOM?")
+
+    try:
+        packs = load_packs(jurisdictions.split(","))
+    except FileNotFoundError as exc:
+        _fail(str(exc))
+
+    if require_verified:
+        offenders = {p.id: [r.id for r in p.unverified_rules]
+                     for p in packs if not p.is_verified}
+        if offenders:
+            detail = "; ".join(f"{k} ({len(v)} rules)" for k, v in offenders.items())
+            _fail(f"--require-verified-policy given, but these packs contain "
+                  f"unverified rules: {detail}. See docs/policy-sources.md.")
+
+    try:
+        cfg = Config.load(config)
+    except FileNotFoundError as exc:
+        _fail(str(exc))
+
+    matrix = build(
+        assets, packs, cfg,
+        crqc_year=crqc_year, migration_years=migration_years,
+        include_acquisition_gate=cnsa_acquisition_gate, strict=strict,
+    )
+    conflicts = detect(matrix, packs)
+
+    renderer = {"matrix": matrix_text, "json": json_out,
+                "md": markdown, "markdown": markdown, "sarif": sarif}.get(fmt)
+    if renderer is None:
+        _fail(f"unknown format {fmt!r}; use matrix, json, md or sarif")
+    typer.echo(renderer.render(matrix, conflicts))
+
+    code = matrix.exit_code
+    if fail_on_warn and code == 0:
+        from cbomctl.models import Verdict
+        if any(r.worst is Verdict.WARN for r in matrix.rows):
+            code = 1
+    raise typer.Exit(code)
+
+
+@app.command()
+def prioritize(
+    cbom: Annotated[str, typer.Argument(help="CBOM JSON path, or - for stdin.")],
+    config: Annotated[Path | None, typer.Option("--config", "-c")] = None,
+    source_format: Annotated[str, typer.Option("--from")] = "auto",
+    crqc_year: Annotated[int, typer.Option("--crqc-year")] = mosca.DEFAULT_CRQC_YEAR,
+    migration_years: Annotated[float | None, typer.Option("--migration-years")] = None,
+) -> None:
+    """Rank findings by Mosca's inequality. Answers *when must I move*."""
+    try:
+        assets, _ = read_assets(cbom, source_format)
+        cfg = Config.load(config)
+    except (CbomParseError, FileNotFoundError) as exc:
+        _fail(str(exc))
+
+    matrix = build(assets, [], cfg, crqc_year=crqc_year, migration_years=migration_years)
+    scored = [r for r in matrix.rows if r.risk]
+    scored.sort(key=lambda r: -r.risk.exposure_years)
+
+    for i, r in enumerate(scored, 1):
+        typer.echo(f"{i:>3}. {r.risk.band.upper():<9} {r.display:<20} {r.purpose:<15} "
+                   f"exposure {r.risk.exposure_years:>5}y  ({r.risk.rationale})")
+        if r.locations:
+            typer.echo(f"     {r.locations[0]}")
+
+    unresolved = [r for r in matrix.rows if r.unscored]
+    if unresolved:
+        typer.echo(f"\nUNRESOLVED ({len(unresolved)}) — not scored, because the "
+                   f"CBOM does not say what they are for:")
+        for r in unresolved:
+            span = " · ".join(f"{k.replace('_', ' ')} → {v}"
+                              for k, v in r.unscored.range_if_guessed.items())
+            typer.echo(f"  {r.display:<20} {r.unscored.reason}"
+                       + (f"  [{span}]" if span else ""))
+            typer.echo(f"     {r.unscored.would_resolve}")
+
+    a = matrix.assumptions
+    typer.echo(f"\nAssumptions: CRQC {a['crqc_year']} ({a['crqc_note']}) · "
+               f"migration {a['migration_years']}y")
+
+
+@app.command()
+def plan(
+    cbom: Annotated[str, typer.Argument(help="CBOM JSON path, or - for stdin.")],
+    jurisdictions: Annotated[str, typer.Option("--jurisdictions", "-j")] = DEFAULT_JURISDICTIONS,
+    config: Annotated[Path | None, typer.Option("--config", "-c")] = None,
+    source_format: Annotated[str, typer.Option("--from")] = "auto",
+    crqc_year: Annotated[int, typer.Option("--crqc-year")] = mosca.DEFAULT_CRQC_YEAR,
+    strict: Annotated[bool, typer.Option("--strict")] = False,
+) -> None:
+    """Ordered migration plan: what to fix first, to what, by whose deadline."""
+    try:
+        assets, _ = read_assets(cbom, source_format)
+        packs = load_packs(jurisdictions.split(","))
+        cfg = Config.load(config)
+    except (CbomParseError, FileNotFoundError) as exc:
+        _fail(str(exc))
+
+    from cbomctl import plan as plan_mod
+
+    matrix = build(assets, packs, cfg, crqc_year=crqc_year, strict=strict)
+    conflicts = detect(matrix, packs)
+    typer.echo(plan_mod.render(matrix, conflicts, packs))
+    raise typer.Exit(matrix.exit_code)
+
+
+@app.command()
+def normalize(
+    cbom: Annotated[str, typer.Argument(help="CBOM JSON path, or - for stdin.")],
+    source_format: Annotated[str, typer.Option("--from")] = "auto",
+) -> None:
+    """Show purpose resolution and which CBOM field decided it."""
+    try:
+        assets, detected = read_assets(cbom, source_format)
+    except CbomParseError as exc:
+        _fail(str(exc))
+    typer.echo(f"# read as {detected}, {len(assets)} assets\n")
+    typer.echo(f"{'ASSET':<22}{'PURPOSE':<15}{'VIA':<18}{'CONSTRUCTION':<12}QUANTUM")
+    for a in assets:
+        typer.echo(f"{a.display:<22}{a.purpose.value:<15}{a.purpose_signal.value:<18}"
+                   f"{a.construction.value:<12}{a.quantum_status.value}")
+        for c in a.purpose_conflicts:
+            typer.echo(f"  ! {c.note}")
+        for ctx in a.corroborating[:1]:
+            typer.echo(f"  ~ corroborating (never decides): {ctx}")
+
+
+policies = typer.Typer(help="Inspect policy packs.", no_args_is_help=True)
+app.add_typer(policies, name="policies")
+
+
+@policies.command("list")
+def policies_list() -> None:
+    """List packs and their verification state."""
+    for pid in available():
+        p = load_pack(pid)
+        unverified = len(p.unverified_rules)
+        state = "VERIFIED" if not unverified else f"{unverified}/{len(p.rules)} UNVERIFIED"
+        typer.echo(f"{p.id:<14} {state:<18} {p.name}")
+    typer.echo("\nNo pack is verified. Rules were assembled from secondary "
+               "reporting; see docs/policy-sources.md.")
+
+
+@policies.command("show")
+def policies_show(pack_id: str) -> None:
+    """Show a pack's rules, sources and open questions."""
+    try:
+        p = load_pack(pack_id)
+    except FileNotFoundError as exc:
+        _fail(str(exc))
+    typer.echo(f"{p.name}  ({p.id} v{p.pack_version})")
+    typer.echo(f"authority: {p.authority}\n")
+    typer.echo(f"applicability: {p.applicability.strip()}\n")
+    for r in p.rules:
+        mark = "✓" if r.status is RuleStatus.VERIFIED else "✗"
+        typer.echo(f"  {mark} {r.id}")
+        typer.echo(f"      {r.description.strip()}")
+        typer.echo(f"      binding={r.binding.value} verdict={r.effective_verdict.value}"
+                   + (f" hybrid={r.hybrid.value}" if r.hybrid else "")
+                   + (f" rationale={r.rationale.value}" if r.rationale else "")
+                   + (f" deadline={r.deadline}" if r.deadline else ""))
+        typer.echo(f"      source: {r.source_title} — {r.source_url}")
+        if r.interpretation.value == "contested":
+            alt = r.alt_reading.value if r.alt_reading else "unspecified"
+            typer.secho(f"      ⚖ CONTESTED ENCODING — alternative reading: {alt}",
+                        fg=typer.colors.YELLOW)
+            for line in (r.interpretation_note or "").strip().split("\n"):
+                if line.strip():
+                    typer.echo(f"        {line.strip()}")
+        if r.open_question:
+            typer.echo(f"      OPEN: {r.open_question.strip()}")
+        typer.echo("")
+
+
+def main() -> None:  # pragma: no cover
+    app()
+
+
+if __name__ == "__main__":  # pragma: no cover
+    main()

cbomctl/config.py

@@ -0,0 +1,102 @@
+"""User-supplied facts a CBOM cannot contain.
+
+The load-bearing one is data lifetime. No inventory tool can derive how long
+data must stay confidential, and without it there is nothing to rank by.
+"""
+
+from __future__ import annotations
+
+import fnmatch
+from pathlib import Path
+from typing import Any
+
+import yaml
+from pydantic import BaseModel, Field
+
+from cbomctl.models import CryptoAsset, Purpose
+
+CONFIG_PROPERTY_PREFIX = "cbomctl:"
+
+
+class AssetRule(BaseModel):
+    match: dict[str, str] = Field(default_factory=dict)
+    data_lifetime_years: float | None = None
+    verification_lifetime_years: float | None = None
+    purpose: Purpose | None = None
+
+
+class Defaults(BaseModel):
+    data_lifetime_years: float = 5.0
+    migration_years: float = 3.0
+    verification_lifetime_years: float | None = None
+
+
+class Config(BaseModel):
+    version: int = 1
+    defaults: Defaults = Field(default_factory=Defaults)
+    system_category: str | None = None
+    assets: list[AssetRule] = Field(default_factory=list)
+
+    @classmethod
+    def load(cls, path: str | Path | None) -> "Config":
+        if path is None:
+            return cls()
+        p = Path(path)
+        if not p.is_file():
+            raise FileNotFoundError(f"config not found: {path}")
+        data = yaml.safe_load(p.read_text(encoding="utf-8")) or {}
+        return cls.model_validate(data)
+
+    def _matches(self, rule: AssetRule, asset: CryptoAsset) -> bool:
+        for key, pattern in rule.match.items():
+            if key == "location":
+                files = [loc.file or "" for loc in asset.locations]
+                if not any(fnmatch.fnmatch(f, pattern) for f in files):
+                    return False
+            elif key == "algorithm":
+                if (asset.algorithm or "").upper() != pattern.upper():
+                    return False
+            elif key == "bom_ref":
+                if asset.bom_ref != pattern:
+                    return False
+            elif key == "purpose":
+                if asset.purpose.value != pattern:
+                    return False
+            else:
+                return False
+        return bool(rule.match)
+
+    def for_asset(self, asset: CryptoAsset) -> tuple[float, str, Purpose | None]:
+        """Return (lifetime_years, source, purpose_override).
+
+        Signatures use verification lifetime where one is supplied: what matters
+        for a signature is how long it stays trusted, not how long the data it
+        covers stays secret.
+        """
+        wants_verification = asset.purpose is Purpose.SIGNATURE
+        for i, rule in enumerate(self.assets):
+            if not self._matches(rule, asset):
+                continue
+            if wants_verification and rule.verification_lifetime_years is not None:
+                return rule.verification_lifetime_years, f"config:assets[{i}].verification_lifetime_years", rule.purpose
+            if rule.data_lifetime_years is not None:
+                return rule.data_lifetime_years, f"config:assets[{i}].data_lifetime_years", rule.purpose
+            if rule.purpose is not None:
+                break
+        if wants_verification and self.defaults.verification_lifetime_years is not None:
+            return self.defaults.verification_lifetime_years, "config:defaults.verification_lifetime_years", None
+        return self.defaults.data_lifetime_years, "config:defaults.data_lifetime_years", None
+
+
+def lifetime_from_properties(component: dict[str, Any]) -> float | None:
+    """Read `cbomctl:data_lifetime_years` from CycloneDX component properties."""
+    for prop in component.get("properties") or []:
+        if not isinstance(prop, dict):
+            continue
+        name = prop.get("name") or ""
+        if name == f"{CONFIG_PROPERTY_PREFIX}data_lifetime_years":
+            try:
+                return float(prop.get("value"))
+            except (TypeError, ValueError):
+                return None
+    return None

cbomctl/loader/__init__.py

@@ -0,0 +1,25 @@
+"""Input detection. Raw CycloneDX is primary; the sbom-tools adapter is opt-in."""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+from cbomctl.loader import cyclonedx, sbom_tools
+from cbomctl.loader.cyclonedx import CbomParseError, load
+from cbomctl.models import CryptoAsset
+
+__all__ = ["CbomParseError", "load", "read_assets"]
+
+
+def read_assets(source: str | Path, fmt: str = "auto") -> tuple[list[CryptoAsset], str]:
+    doc = load(source)
+    if fmt == "sbom-tools" or (fmt == "auto" and sbom_tools.is_sbom_tools(doc)):
+        return sbom_tools.to_assets(doc), "sbom-tools"
+    if fmt in ("auto", "cyclonedx"):
+        if fmt == "auto" and not cyclonedx.is_cyclonedx(doc):
+            raise CbomParseError(
+                "input is neither a CycloneDX document nor recognisable "
+                "sbom-tools output; pass --from to force a reader"
+            )
+        return cyclonedx.to_assets(doc), "cyclonedx"
+    raise CbomParseError(f"unknown input format: {fmt}")

cbomctl/loader/cyclonedx.py

@@ -0,0 +1,124 @@
+"""Read a CycloneDX 1.6 / 1.7 CBOM.
+
+1.7 is a superset of 1.6 in the crypto subtree, so one reader serves both.
+Unrecognised enum values degrade to UNKNOWN rather than raising: a future 1.8
+adding a primitive must not crash a CI gate.
+"""
+
+from __future__ import annotations
+
+import json
+from pathlib import Path
+from typing import Any
+
+from cbomctl.models import CryptoAsset, Location
+from cbomctl.normalize import identity, purpose as purpose_mod
+from cbomctl.normalize.oids import lookup as oid_lookup
+
+
+class CbomParseError(ValueError):
+    pass
+
+
+def load(source: str | Path) -> dict[str, Any]:
+    raw = _read(source)
+    try:
+        doc = json.loads(raw)
+    except json.JSONDecodeError as exc:  # pragma: no cover - message path
+        raise CbomParseError(f"not valid JSON: {exc}") from exc
+    if not isinstance(doc, dict):
+        raise CbomParseError("top level of a CBOM must be an object")
+    return doc
+
+
+def _read(source: str | Path) -> str:
+    if source == "-":
+        import sys
+
+        return sys.stdin.read()
+    p = Path(source)
+    if not p.is_file():
+        raise CbomParseError(f"no such file: {source}")
+    return p.read_text(encoding="utf-8")
+
+
+def is_cyclonedx(doc: dict[str, Any]) -> bool:
+    return doc.get("bomFormat") == "CycloneDX" or "specVersion" in doc
+
+
+def _locations(component: dict[str, Any]) -> list[Location]:
+    occurrences = (component.get("evidence") or {}).get("occurrences") or []
+    out: list[Location] = []
+    for o in occurrences:
+        if not isinstance(o, dict):
+            continue
+        out.append(Location(
+            file=o.get("location"),
+            line=o.get("line"),
+            context=o.get("additionalContext"),
+        ))
+    return out
+
+
+def to_assets(doc: dict[str, Any]) -> list[CryptoAsset]:
+    spec = str(doc.get("specVersion") or "")
+    assets: list[CryptoAsset] = []
+
+    for comp in doc.get("components") or []:
+        if not isinstance(comp, dict):
+            continue
+        cp = comp.get("cryptoProperties")
+        if not isinstance(cp, dict):
+            continue
+
+        algo = cp.get("algorithmProperties") or {}
+        raw_name = comp.get("name") or comp.get("bom-ref") or "<unnamed>"
+        primitive = algo.get("primitive")
+        functions = algo.get("cryptoFunctions") or []
+        oid = cp.get("oid")
+
+        res = purpose_mod.resolve(
+            raw_name=raw_name,
+            crypto_functions=list(functions) if isinstance(functions, list) else None,
+            primitive=primitive,
+            oid=oid,
+        )
+
+        entry = oid_lookup(oid)
+        # 1.7 renamed `curve` to `ellipticCurve`; both may appear.
+        curve = identity.parse_curve(
+            raw_name, algo.get("ellipticCurve") or algo.get("curve"))
+        param = algo.get("parameterSetIdentifier")
+
+        locations = _locations(comp)
+        corroborating = [loc.context for loc in locations if loc.context]
+
+        assets.append(CryptoAsset(
+            bom_ref=comp.get("bom-ref") or raw_name,
+            raw_name=raw_name,
+            # `algorithmFamily` is 1.7-only; fall back to the OID's canonical
+            # name, then to parsing the free-text name.
+            algorithm=(algo.get("algorithmFamily")
+                       or (entry.algorithm if entry else None)
+                       or identity.family(raw_name)),
+            purpose=res.purpose,
+            purpose_signal=res.signal,
+            purpose_conflicts=res.conflicts,
+            construction=identity.classify_construction(raw_name, primitive),
+            quantum_status=identity.classify_quantum(raw_name),
+            key_size=identity.parse_key_size(raw_name, param),
+            security_strength=identity.security_strength(
+                raw_name,
+                declared=algo.get("classicalSecurityLevel"),
+                key_size=identity.parse_key_size(raw_name, param),
+                curve=curve,
+            ),
+            parameter_set=param if param and not str(param).isdigit() else None,
+            curve=curve,
+            oid=oid,
+            asset_type=cp.get("assetType") or "algorithm",
+            locations=locations,
+            corroborating=sorted(set(corroborating)),
+            spec_version=spec or None,
+        ))
+    return assets

cbomctl/loader/sbom_tools.py

@@ -0,0 +1,101 @@
+"""Optional adapter for `sbom-tools` normalized JSON.
+
+Best-effort and clearly labelled as such. Their `Component` derives `Serialize`
+with no serde renames, so fields arrive snake_cased — but that is an
+implementation detail read from source, not a documented contract. We have
+asked upstream whether the payload is stable; until they answer this adapter
+may break, and it says so rather than failing silently.
+
+Known lossy point: their parser maps an absent `primitive` and an explicit
+`primitive: "unknown"` to the same value, so this path cannot tell a generator
+that omitted the field from one that said it did not know. Both still resolve
+to Purpose.UNKNOWN, so no verdict changes — but the diagnostic is gone.
+"""
+
+from __future__ import annotations
+
+from typing import Any
+
+from cbomctl.models import CryptoAsset
+from cbomctl.normalize import identity, purpose as purpose_mod
+from cbomctl.normalize.oids import lookup as oid_lookup
+
+#: snake_case -> CycloneDX camelCase for the fields we consume.
+_PRIMITIVE_FROM_RUST = {
+    "Ae": "ae", "BlockCipher": "block-cipher", "StreamCipher": "stream-cipher",
+    "Hash": "hash", "Mac": "mac", "Signature": "signature", "Pke": "pke",
+    "Kem": "kem", "Kdf": "kdf", "KeyAgree": "key-agree", "Xof": "xof",
+    "Drbg": "drbg", "Combiner": "combiner", "Unknown": "unknown",
+}
+_FUNCTION_FROM_RUST = {
+    "Encrypt": "encrypt", "Decrypt": "decrypt", "Sign": "sign", "Verify": "verify",
+    "Encapsulate": "encapsulate", "Decapsulate": "decapsulate", "Digest": "digest",
+    "Tag": "tag", "Keyderive": "keyderive", "KeyDerive": "keyderive",
+    "Keygen": "keygen", "Generate": "generate", "Other": "other", "Unknown": "unknown",
+}
+
+
+def is_sbom_tools(doc: dict[str, Any]) -> bool:
+    comps = doc.get("components")
+    if not isinstance(comps, list) or not comps:
+        return False
+    return any(isinstance(c, dict) and "crypto_properties" in c for c in comps)
+
+
+def _norm(value: Any, table: dict[str, str]) -> str | None:
+    if value is None:
+        return None
+    if isinstance(value, dict):  # externally tagged enum, e.g. {"Other": "..."}
+        value = next(iter(value), None)
+    return table.get(str(value), str(value).lower())
+
+
+def to_assets(doc: dict[str, Any]) -> list[CryptoAsset]:
+    assets: list[CryptoAsset] = []
+    for comp in doc.get("components") or []:
+        if not isinstance(comp, dict):
+            continue
+        cp = comp.get("crypto_properties")
+        if not isinstance(cp, dict):
+            continue
+        algo = cp.get("algorithm_properties") or {}
+        raw_name = comp.get("name") or "<unnamed>"
+        primitive = _norm(algo.get("primitive"), _PRIMITIVE_FROM_RUST)
+        functions = [_norm(f, _FUNCTION_FROM_RUST)
+                     for f in (algo.get("crypto_functions") or [])]
+        oid = cp.get("oid")
+
+        curve = identity.parse_curve(raw_name, algo.get("elliptic_curve"))
+        res = purpose_mod.resolve(
+            raw_name=raw_name,
+            crypto_functions=[f for f in functions if f],
+            primitive=primitive,
+            oid=oid,
+        )
+        entry = oid_lookup(oid)
+        param = algo.get("parameter_set_identifier")
+        assets.append(CryptoAsset(
+            bom_ref=comp.get("bom_ref") or comp.get("bom-ref") or raw_name,
+            raw_name=raw_name,
+            algorithm=(algo.get("algorithm_family")
+                       or (entry.algorithm if entry else None)
+                       or identity.family(raw_name)),
+            purpose=res.purpose,
+            purpose_signal=res.signal,
+            purpose_conflicts=res.conflicts,
+            construction=identity.classify_construction(raw_name, primitive),
+            quantum_status=identity.classify_quantum(raw_name),
+            key_size=identity.parse_key_size(raw_name, param),
+            security_strength=identity.security_strength(
+                raw_name,
+                declared=algo.get("classical_security_level"),
+                key_size=identity.parse_key_size(raw_name, param),
+                curve=curve,
+            ),
+            parameter_set=param if param and not str(param).isdigit() else None,
+            curve=curve,
+            oid=oid,
+            asset_type=str(cp.get("asset_type") or "algorithm").lower(),
+            spec_version="sbom-tools",
+        ))
+    return assets